> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nomadicml.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Nomadic AI on Azure

> Architecture, read and write paths, private connectivity over Azure Private Link, and purchasing through the Azure Marketplace.

# Nomadic AI on Azure

This page describes how the video analysis platform is deployed in Microsoft Azure, how data moves through it on the read and write paths, how client applications reach it privately over Azure Private Link, and how the offer is transacted through the Azure Marketplace.

<Note>
  Looking to run the whole stack inside your own subscription instead? See [Self-Hosted VPC Setup](/getting-started/vpc-setup), or deploy the same stack straight from the listing as an [Azure managed application](#azure-marketplace). For the other clouds, see [Nomadic AI on AWS](/deployment/aws) and [Nomadic AI on GCP](/deployment/gcp).
</Note>

## General Architecture

The platform runs inside a Nomadic-managed virtual network. Client applications never reach it over the public internet. They create a private endpoint in their own virtual network, which takes a private IP address from one of their subnets and connects to a Private Link service we publish. Everything behind that Private Link service (load balancer, application tier, storage and inference) runs in private subnets with no public IP address.

```mermaid theme={null}
flowchart TB
    subgraph client["Client virtual network"]
        A["Client applications"]
        B["Private endpoint<br/>network interface, private IP"]
        A --> B
    end

    subgraph nml["Nomadic AI virtual network"]
        C["Private Link service<br/>plus NAT subnet"]
        D["Internal load balancer<br/>Standard SKU, no public IP"]
        E["API service"]
        F["Analysis workers"]
        G[("Azure Blob Storage<br/>video and artifacts")]
        H[("Azure Cosmos DB<br/>metadata")]
        I[("Azure Cache for Redis<br/>progress streams")]
        J["Azure AI Foundry<br/>model inference"]
    end

    B -->|"Azure Private Link"| C
    C --> D
    D --> E
    E --> F
    E --> G
    E --> H
    F --> G
    F --> H
    F --> I
    F --> J
```

### Key Components

<CardGroup cols={2}>
  <Card title="Private Link service" icon="shield-halved">
    The published service a client connects to. Its visibility setting names exactly which Azure subscriptions may request a connection, and each private endpoint connection is approved individually.
  </Card>

  <Card title="Internal load balancer" icon="scale-balanced">
    A Standard SKU internal load balancer with no public IP. Fronts the application tier and is the backend the Private Link service targets.
  </Card>

  <Card title="Application tier" icon="server">
    Virtual machine scale set backends. The API service handles authentication, upload and result retrieval. Analysis workers claim queued jobs on a lease and run the analysis out of band.
  </Card>

  <Card title="Data services" icon="database">
    Azure Blob Storage for video and derived artifacts, Azure Cosmos DB for job and analysis metadata, Azure Cache for Redis for progress streams, Azure AI Foundry for model inference. All are reached through private endpoints, so no traffic traverses the public internet.
  </Card>
</CardGroup>

## Read Path

A client asks for job status, analysis results, or the media behind them. The request enters through the private endpoint and is served from the two data stores inside the virtual network.

```mermaid theme={null}
flowchart LR
    subgraph client["Client virtual network"]
        A["Client application<br/>status, results, media"]
    end

    subgraph nml["Nomadic AI virtual network"]
        B["Private Link service"]
        C["API service<br/>authenticates API key"]
        D[("Azure Cosmos DB")]
        E[("Azure Blob Storage")]
    end

    A <-->|"Azure Private Link"| B
    B <--> C
    C <-->|"analysis document"| D
    C <-->|"video and artifacts"| E
```

### Read Path Flow

1. **Client application** sends the request to the private endpoint in its own subnet, reached by a private IP address and the record in its private DNS zone.
2. **Private Link service** accepts the connection from an approved subscription and passes it to the internal load balancer.
3. **API service** authenticates the API key and resolves what was asked for: job status, an analysis document, or media.
4. **Azure Cosmos DB and Azure Blob Storage** return the analysis document and the video or derived artifacts behind it. Results travel back on the connection the client already opened.

## Write Path

Upload and analysis are decoupled, so a long-running analysis never holds a client connection open.

```mermaid theme={null}
flowchart LR
    subgraph client["Client virtual network"]
        A["Client application"]
    end

    subgraph nml["Nomadic AI virtual network"]
        B["API service"]
        C["Analysis workers"]
        D[("Azure Blob Storage")]
        E[("Azure Cosmos DB")]
        F["Azure AI Foundry"]
        G["Azure Cache for Redis<br/>progress stream"]
    end

    A -->|"video upload via Private Link"| B
    B -->|"video, sync write"| D
    B -->|"queued job"| C
    C -->|"artifacts"| D
    C -->|"results"| E
    C <-->|"frames and prompts"| F
    C -->|"progress events"| G
    G -->|"SSE progress"| A
```

### Write Path Flow

The API service writes video to Azure Blob Storage synchronously and records a job document in Azure Cosmos DB, then returns. The upload is complete at that point. Analysis workers claim the queued job on a lease, marking it in progress so no two workers take the same job, and call Azure AI Foundry for inference. As they run they publish progress events to an Azure Cache for Redis stream, which the API service relays to the client as server-sent events. Finished results are written back to Azure Cosmos DB and derived artifacts to Blob Storage, where the read path picks them up.

## Private Connectivity

Azure Private Link is two resources, one in each subscription. Nomadic AI publishes the Private Link service; the client creates a private endpoint in their own virtual network. Traffic between them stays on the Microsoft backbone.

* **The connection is one-way.** The client initiates. Nomadic AI cannot reach back into the client network, so exposure is limited to the single published service rather than a route between two networks.
* **Consumption is restricted by visibility.** The Private Link service names which subscriptions may request a connection, and with manual approval each private endpoint connection request is approved individually.
* **No address-space coordination.** A dedicated NAT subnet in our network translates consumer traffic, so the two networks are IP independent and overlapping ranges are irrelevant.
* **DNS is yours to point.** Azure does not create records in your network for you. You create a private DNS zone linked to your virtual network with an A record for the endpoint's private IP, so your SDK resolves it without configuration changes.
* **Nothing needs a public IP.** Your side needs no NAT gateway or public address for this path, and our load balancer is internal.

The equivalent primitive on AWS is [PrivateLink](/deployment/aws) and on GCP is [Private Service Connect](/deployment/gcp). All three follow the same publish-and-consume shape.

## Azure Marketplace

The Nomadic platform is transacted through the Azure Marketplace, so the subscription is purchased, billed and governed with the rest of your Azure spend rather than through a separate contract and invoice.

### Offer Types

<CardGroup cols={2}>
  <Card title="SaaS offer" icon="cart-shopping">
    You subscribe in the Marketplace and we run the platform. Azure is a procurement and billing channel only; nothing is deployed into your subscription. This is the path for the fully managed and hybrid models.
  </Card>

  <Card title="Azure managed application" icon="box">
    The stack deploys into your own subscription from the Marketplace listing, into a managed resource group. This is the path for the in-VNet model when you want the deployment to arrive through the Marketplace rather than through a Terraform handoff.
  </Card>
</CardGroup>

### Purchase Flow

1. **Find the offer** in the Azure portal under Marketplace, or open the listing link we provide. Negotiated pricing and terms arrive as a private offer visible only to your billing account.
2. **Subscribe** against the Azure subscription you want billed, choosing a plan and the number of seats or the usage tier.
3. **Configure the account.** Azure sends you to our landing page with a purchase token. Sign in with Microsoft Entra ID, confirm the organization the subscription maps to, and we activate the entitlement.
4. **Start using the platform.** Your Marketplace subscription maps to a Nomadic AI organization, and existing API keys and SDK configuration keep working unchanged.
5. **Get billed on your Azure invoice.** Charges appear as a Marketplace line item on the subscription you purchased against. Plan changes, seat changes and cancellation are all done from the Azure portal and are reflected in your entitlement.

### Governance

| Concern                 | How it works                                                                                                                                                             |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Identity**            | Sign-in uses Microsoft Entra ID. The purchasing account is the first administrator of the mapped organization.                                                           |
| **Billing**             | A Marketplace line item on the Azure subscription you purchased against, under your existing billing profile and cost management views.                                  |
| **Commitment drawdown** | Eligible offers draw down against a Microsoft Azure Consumption Commitment. Ask us to confirm eligibility for the plan you are buying.                                   |
| **Private offers**      | Negotiated price, term and custom terms are delivered as a private offer scoped to your billing account.                                                                 |
| **Lifecycle**           | Suspension, plan change and cancellation events from Azure are synchronized to the entitlement, so access matches what you are paying for.                               |
| **Data deletion**       | Cancelling the subscription starts the deletion path for the mapped organization's data under the terms in the [Main Services Agreement](/more/main-services-agreement). |

<Note>
  The listing is live in the Azure Marketplace. Search for Nomadic AI in the Azure portal to subscribe, or contact your Nomadic AI representative to have a private offer prepared for your billing account.
</Note>

## Deployment Models

Three options, differing in whose subscription holds the application and whose holds the data.

<CardGroup cols={3}>
  <Card title="Fully managed" icon="cloud">
    Nomadic AI runs both the application and the data services in our Azure subscription. Clients connect over Private Link. Lowest operational burden.
  </Card>

  <Card title="In your VNet" icon="lock">
    The entire stack deploys into your Azure subscription, in a virtual network with no public ingress and no NAT gateway. Video never leaves your subscription and we hold no credentials into it.
  </Card>

  <Card title="Hybrid" icon="shuffle">
    We run the application; you supply the storage accounts. Access is granted by a managed identity with Azure RBAC role assignments rather than stored account keys.
  </Card>
</CardGroup>

|                             | Fully managed           | In your VNet                    | Hybrid                                |
| --------------------------- | ----------------------- | ------------------------------- | ------------------------------------- |
| **Application runs in**     | Nomadic AI subscription | Your subscription               | Nomadic AI subscription               |
| **Video at rest in**        | Nomadic AI subscription | Your subscription               | Your subscription                     |
| **Metadata at rest in**     | Nomadic AI subscription | Your subscription               | Nomadic AI subscription               |
| **Reached over**            | Private Link            | Internal load balancer          | Private Link                          |
| **Credentials we hold**     | None                    | None                            | Managed identity, no keys             |
| **Your operational burden** | None                    | Subscription, quotas, upgrades  | Storage accounts and role assignments |
| **Purchased through**       | Marketplace SaaS offer  | Marketplace managed application | Marketplace SaaS offer                |
| **Available today**         | Yes                     | Yes                             | Yes                                   |

Setup steps for the in-VNet model are covered in [Self-Hosted VPC Setup](/getting-started/vpc-setup).

## What You Provide

For a Private Link connection to the managed service, the client side needs very little.

| Item                                     | Detail                                                                                                                                                            |
| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Subscription ID and region**           | The consumer subscription, and the region your private endpoint will live in. Tell us the region and we will publish the Private Link service there.              |
| **Subscription for the visibility list** | The subscription allowed to request a connection to the Private Link service. We add it before you create the endpoint.                                           |
| **Private endpoint**                     | Created in your virtual network against the Private Link service alias we provide, with a private IP address from one of your subnets.                            |
| **Subnet and network security group**    | A subnet in the target region for the endpoint IP, and rules allowing your application to reach it on TCP 443.                                                    |
| **Private DNS zone**                     | A zone linked to your virtual network with an A record pointing our hostname at the endpoint's private IP, so your SDK resolves it without configuration changes. |
| **Storage private endpoint**             | Recommended. Where results reference media by SAS URL, a Blob Storage private endpoint keeps that fetch off the public internet too.                              |

<Note>
  Deployments are configured per customer. Contact your Nomadic AI representative with your Azure subscription ID, target region, and preferred deployment model, and we will publish the Private Link service and share its alias along with the Marketplace offer details.
</Note>